Table 1 shows the characteristics of the IoT botnet scenarios and Table 2 shows the protocols that were found in each network traffic capture. On each malicious scenario we executed a specific malware sample in a Raspberry Pi, that used several protocols and performed different actions. These scenarios are divided into twenty network captures (pcap files) from infected IoT devices (which will have the name of the malware sample executed on each scenario) and three network captures of real IoT devices network traffic (that have the name of the devices where the traffic was captured). The IoT-23 dataset consists of twenty three captures (called scenarios) of different IoT network traffic. This dataset and its research is funded by Avast Software, Prague. Its goal is to offer a large dataset of real and labeled IoT malware infections and IoT benign traffic for researchers to develop machine learning algorithms. This IoT network traffic was captured in the Stratosphere Laboratory, AIC group, FEL, CTU University, Czech Republic. It was first published in January 2020, with captures ranging from 2018 to 2019. It has 20 malware captures executed in IoT devices, and 3 captures for benign IoT devices traffic. IoT-23 is a new dataset of network traffic from Internet of Things (IoT) devices. ” Downloadĭownload the full IoT-23 dataset (21 GB) here:ĭownload a lighter version containing only the labeled flows without the pcaps files (8.8 GB) here:ĭownload the design of how the labels were assigned from this spreadsheet IoT-23: A labeled dataset with malicious and benign IoT network traffic (Version 1.0.0). If you are using this dataset for your research, please reference it as “Sebastian Garcia, Agustin Parmisano, & Maria Jose Erquiaga.

Malware analysis traffic